Skip to main content
Use the ZEDEDA CLI (ZCLI) to manage data streams from the command line. This article covers zcli datastream commands, with syntax and examples for each operation. A data stream is a pipeline that exports one type of platform data (application logs, events, or metrics) from Edge Infrastructure Services to a connected integration, such as Splunk or an OpenTelemetry collector. ZCLI calls the integration a plugin. This page is the command reference. To set up the integration that a data stream sends data to, see Splunk Integration or OpenTelemetry Integration. For the console view of data streams, see Enterprise Settings.

​
Before You Start

  • ZCLI is installed and authenticated against your enterprise. See Get Started.
  • You have the SysAdmin role in your enterprise. See Manage Roles.
  • The integration (plugin) that the data stream sends data to already exists, and you know its ID. See Find the plugin ID.

​
Create a Data Stream

​
Find the plugin ID

--plugin takes the plugin ID, not its name. ZCLI sends the value exactly as you type it and does not check it. To find the ID, list your plugins, and then show the plugin that you want with --detail. The ID is in the Plugin ID line.
  1. List your plugins:
  2. Show the plugin that you want with --detail:

​
Create a data stream

Create a data stream that sends one source type to one plugin.
To export more than one source type, create one data stream for each type. Example: send events to a plugin and start the stream immediately:
On success, ZCLI prints nothing. To confirm the result, run zcli datastream show MY_EVENTS_STREAM --detail.
The example in zcli datastream --help (zcli datastream create events_stream --source=events --enabled=true) leaves out the required --plugin flag. If you run it as written, ZCLI prints the usage text and creates nothing.
ZCLI does not validate --source before it uses it. A value other than app-logs, events, or metrics, such as logs or Events, stops the command with an Unexpected error executing command 'datastream' message that names KeyError and the invalid value. No data stream is created.

​
Values for the enabled flag

--enabled accepts the following values. They are not case-sensitive. Any other value, such as enable or disabled, stops ZCLI with a Python ValueError traceback. No change is made.

​
View Data Streams

​
View a single data stream

Show one data stream by name or UUID. Add --detail to see all of its fields.
Example:
The --detail output includes the data stream’s ID, title, description, source type (APP_LOGS, EVENTS, or METRICS), enabled state, plugin ID, and creation and update history.
Without --detail, the DataStream Title line of the output is always empty because of an error in the ZCLI output template. Use --detail to see the title.

​
List data streams

Run zcli datastream show without a name to list all data streams. The list shows each stream’s name, title, source type, and enabled state. It does not show the plugin. Use the following flags to filter the list. You can use only one filter at a time. To list all data streams:
To list data streams whose name contains EVENTS:
To list data streams of the metrics source type:

​
Update a Data Stream

Change a data stream’s plugin, enabled state, title, or description. You cannot change the source type. To export a different source type, create a new data stream.
ZCLI reads the current data stream, changes only the fields that you pass, and sends the result back. Fields that you do not pass keep their current values. If you pass no options, ZCLI prints Nothing to update and makes no change.

​
Pause or resume a data stream

To stop forwarding data without deleting the stream, set --enabled=false. To resume, set --enabled=true. To pause a data stream:
To resume a data stream:

​
Send a data stream to a different plugin

​
Delete a Data Stream

Delete a data stream by name. ZCLI asks Delete datastream <name>? [Y/N] unless you pass -f. If you answer no, ZCLI prints Datastream <name> not deleted.
Example:
To stop exporting data temporarily, pause the stream instead. See Pause or resume a data stream.

​
Next Steps

Splunk Integration

Connect Edge Infrastructure Services to a Splunk HTTP Event Collector.

OpenTelemetry Integration

Connect Edge Infrastructure Services to an OpenTelemetry collector.

View Events

Show events from your edge nodes and the log of user actions.

Overview

All ZCLI command procedures, organized by resource type.